URLs in alerts are correct but being routed to the wrong app and returns 404

[neiljpeterson]

Generated links in alerts are being routed to an old name of an app even though the path is correct.

The name change was just a change in case (eg MyApp to myapp) because it was causing an issue with savedsearches.conf

Now when an alert goes out the link is (spaces added to escape auto-formatting)

https:// splunk.domain. net/app/myapp/@go?sid=rt_scheduler_bmVpbC5wZXRlcnNvbg__myapp__RMD5ec95cf321e8ea7ff_at_1401458542_0.246

HOWEVER the browser is actually routed to

https://splunk.domain.net/app/MyApp/@go?sid=rt_scheduler_bmVpbC5wZXRlcnNvbg__myapp__RMD5ec95cf321e8ea7ff_at_1401458542_0.246

I reinstalled the app, restarted the server and did a /debug/refresh the links still are not working correctly.

What are my next steps?

[neiljpeterson · Accepted solution]

So I found the issue here.

There was a duplicate stanza in $SPLUNK_HOME\etc\users\my.user\myapp\local\savedsearches.conf that had the old app name for request.ui_dispatch_app

This stanza was trumping the stanza in app directory.

I think this happened because I manually copied the savedsearch to the app directory but forgot to remove it from my user\app\local directory.

A great lesson in conf file order of precedence.

[MuS]

nice done 🙂

[MuS]

Hi neiljipeterson,

did you check app.conf in your app directory does that match the new name, also check if the directory in $SPLUNK_HOME/etc/apps/ matches the new name.

I just did a test renaming my test app mySandBox to myfooBOX by changing the label in app.conf but not changing the directory in $SPLUNK_HOME/etc/apps/. So now my app is labeled myfooBOX in Splunk but the URL is still pointing to http://mysplunkserver/en-US/app/mySandBox/search ...

hope this helps ...

cheers, MuS

[neiljpeterson]

No, the app label still has the capital letters. I would like to leave it that way. But just for testing I did change it and it does not seem to have an effect on the URL, nor would I expect it to. Most apps have different labels than their physical paths, right?

Yes, the physical path is correct and has the new name.